{"id":4297,"date":"2020-01-04T20:38:41","date_gmt":"2020-01-04T17:38:41","guid":{"rendered":"http:\/\/vahamartti.fi\/blog\/?p=4297"},"modified":"2020-01-05T14:15:10","modified_gmt":"2020-01-05T11:15:10","slug":"ssl-vpnn-kayttoonotto-draytek-vigor-2960-reitittimessa","status":"publish","type":"post","link":"https:\/\/vahamartti.fi\/blog\/?p=4297","title":{"rendered":"SSL VPN:n k\u00e4ytt\u00f6\u00f6notto DrayTek Vigor 2960 reitittimess\u00e4"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Esimerkin kuvat on otettu DrayTek Vigor 2960 firmware versio 1.4.4:n k\u00e4ytt\u00f6liittym\u00e4st\u00e4.<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Jotta voit k\u00e4ytt\u00e4\u00e4 VPN:\u00e4\u00e4, tarvitset kiinte\u00e4n IP-osoitteen tai voit k\u00e4ytt\u00e4\u00e4 Dynaamista DNS:\u00e4\u00e4, esimerkiksi <a rel=\"noreferrer noopener\" aria-label=\"DrayDDNS (opens in a new tab)\" href=\"http:\/\/vahamartti.fi\/blog\/?p=4277\" target=\"_blank\">DrayDDNS<\/a>.<\/li><li>Aktivoidaan SSL palvelu: Remote Access =&gt; Remote Access Control, t\u00e4pp\u00e4 kohtaan Enable SSL Tunnel Service<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"328\" src=\"http:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_enable_service-1024x328.png\" alt=\"\" class=\"wp-image-4290\" srcset=\"https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_enable_service-1024x328.png 1024w, https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_enable_service-253x81.png 253w, https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_enable_service-768x246.png 768w, https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_enable_service.png 1201w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\"><li>Aktivoidaan reititin kuuntelemaan SSL porttia WAN:in puolelta: System Maintenance =&gt; Access Control =&gt; Access Control, t\u00e4pp\u00e4 kohtaan HTTPS Allow: Enable. SSL VPN:n lis\u00e4ksi t\u00e4st\u00e4 muutoksesta seuraa reitittimen hallintasivulle p\u00e4\u00e4sy internetin puolelta. <br><br>Vaikka portin vaihtaminen ei p\u00e4\u00e4sy\u00e4 hallintasivulle est\u00e4 ja porttiskannauksen tekeminen on helppoa avoimen portin l\u00f6yt\u00e4miseksi, HTTPS portin vaihtaminen 443 =&gt; esim. 4430 voi parantaa hieman turvallisuutta (DrayTek:in suositus).<br><br>Access List:in k\u00e4ytt\u00f6 est\u00e4\u00e4 hallintasivulle p\u00e4\u00e4syn, mutta se est\u00e4\u00e4 my\u00f6s SSL VPN yhteydet. T\u00e4st\u00e4 ominaisuudesta on hy\u00f6ty\u00e4 vain, jos p\u00e4\u00e4telaitteella on k\u00e4yt\u00f6ss\u00e4 kiinte\u00e4 julkinen IP (matkaava WLAN:ien k\u00e4ytt\u00e4j\u00e4 ei t\u00e4llaista p\u00e4iv\u00e4\u00e4 n\u00e4e).<br><br>Reitittimen hallintasivun salasana on syyt\u00e4 olla vahva, vaihtoehtoisesti voi k\u00e4ytt\u00e4\u00e4 mOTP (mobile One-Time-Password) ominaisuutta, jossa salasana vaihtuu minuutin v\u00e4lein.<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"884\" src=\"http:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_https_allow-1-1024x884.png\" alt=\"\" class=\"wp-image-4293\" srcset=\"https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_https_allow-1-1024x884.png 1024w, https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_https_allow-1-253x218.png 253w, https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_https_allow-1-768x663.png 768w, https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_https_allow-1.png 1094w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"4\"><li>Koska IP osoitteiden rajoittaminen ei ole mahdollista, voi reitittimen m\u00e4\u00e4ritell\u00e4 pist\u00e4m\u00e4\u00e4n IP osoitteet j\u00e4\u00e4hylle m\u00e4\u00e4r\u00e4ajaksi, jotka ovat sy\u00f6tt\u00e4neet salasanan v\u00e4\u00e4rin x kertaa per\u00e4kk\u00e4in. System Maintenance =&gt; Access Control =&gt; Fail to Ban,  t\u00e4pp\u00e4 Enable Fail to Ban:iin, sek\u00e4 muihin Enableihin.<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"815\" height=\"737\" src=\"http:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_fail2ban.png\" alt=\"\" class=\"wp-image-4294\" srcset=\"https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_fail2ban.png 815w, https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_fail2ban-253x229.png 253w, https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_fail2ban-768x694.png 768w\" sizes=\"auto, (max-width: 815px) 100vw, 815px\" \/><\/figure>\n\n\n\n<ol class=\"wp-block-list\" start=\"5\"><li>Luodaan k\u00e4ytt\u00e4j\u00e4profiili, eli k\u00e4ytt\u00e4j\u00e4tunnus ja salasana: User Management =&gt; User Profile. M\u00e4\u00e4ritell\u00e4\u00e4n k\u00e4ytt\u00e4j\u00e4nimi, aktivoidaan tili (Enable), salasana, sek\u00e4 sallitaan SSL tunnelin k\u00e4ytt\u00f6 ko. k\u00e4ytt\u00e4j\u00e4lle.<\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"602\" height=\"846\" src=\"http:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_user.png\" alt=\"\" class=\"wp-image-4295\" srcset=\"https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_user.png 602w, https:\/\/vahamartti.fi\/blog\/wp-content\/uploads\/2020\/01\/SSL_user-180x253.png 180w\" sizes=\"auto, (max-width: 602px) 100vw, 602px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Reitittimen p\u00e4\u00e4n asetukset ovat t\u00e4ss\u00e4. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">P\u00e4\u00e4telaitteella, esimerkiksi matkapuhelimessa tulee en\u00e4\u00e4 m\u00e4\u00e4ritell\u00e4 VPN palvelimen osoite, portti (443), k\u00e4ytt\u00e4j\u00e4tunnus, salasana sek\u00e4 yhteyden tyyppi (SSL). <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">P\u00e4\u00e4teohjelmia eri alustoille l\u00f6ytyy DtayTekin <a rel=\"noreferrer noopener\" aria-label=\"sivuilta (opens in a new tab)\" href=\"https:\/\/www.draytek.com\/products\/smart-vpn-client\/\" target=\"_blank\">sivuilta<\/a>. <\/p>\n\n\n<p><!--EndFragment--><\/p>","protected":false},"excerpt":{"rendered":"<p>Esimerkin kuvat on otettu DrayTek Vigor 2960 firmware versio 1.4.4:n k\u00e4ytt\u00f6liittym\u00e4st\u00e4. Jotta voit k\u00e4ytt\u00e4\u00e4 VPN:\u00e4\u00e4, tarvitset kiinte\u00e4n IP-osoitteen tai voit k\u00e4ytt\u00e4\u00e4 Dynaamista DNS:\u00e4\u00e4, esimerkiksi DrayDDNS. Aktivoidaan SSL palvelu: Remote Access =&gt; Remote Access Control, t\u00e4pp\u00e4 kohtaan Enable SSL Tunnel Service Aktivoidaan reititin kuuntelemaan SSL porttia WAN:in puolelta: System Maintenance =&gt; Access Control =&gt; Access Control, &hellip; <a href=\"https:\/\/vahamartti.fi\/blog\/?p=4297\" class=\"more-link\">Jatka lukemista <span class=\"screen-reader-text\">SSL VPN:n k\u00e4ytt\u00f6\u00f6notto DrayTek Vigor 2960 reitittimess\u00e4<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[30,384],"tags":[1069,1057,1070,1067,306],"class_list":["post-4297","post","type-post","status-publish","format-standard","hentry","category-saatoa","category-vinkit","tag-1069","tag-draytek","tag-ssl","tag-vigor","tag-vpn"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p1fteB-17j","jetpack_sharing_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/vahamartti.fi\/blog\/index.php?rest_route=\/wp\/v2\/posts\/4297","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vahamartti.fi\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vahamartti.fi\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vahamartti.fi\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vahamartti.fi\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4297"}],"version-history":[{"count":5,"href":"https:\/\/vahamartti.fi\/blog\/index.php?rest_route=\/wp\/v2\/posts\/4297\/revisions"}],"predecessor-version":[{"id":4309,"href":"https:\/\/vahamartti.fi\/blog\/index.php?rest_route=\/wp\/v2\/posts\/4297\/revisions\/4309"}],"wp:attachment":[{"href":"https:\/\/vahamartti.fi\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4297"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vahamartti.fi\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4297"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vahamartti.fi\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4297"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}